fc49ee4702a7c9d95dfaea0a014e3ff6cc678baa96361159fc459f016dfcba9d | Triage

Sharing

General

Target

fc49ee4702a7c9d95dfaea0a014e3ff6cc678baa96361159fc459f016dfcba9d
Size

370KB
Sample

231013-dv86wseb68
MD5

42578f059b473b2a62e141ab2a1a6ad4
SHA1

20f774b65ab478e5c661f3cb321b4ade47d4c7ae
SHA256

fc49ee4702a7c9d95dfaea0a014e3ff6cc678baa96361159fc459f016dfcba9d
SHA512

c797307fa268f857769b1158ec23a702be0c9f470cc521f01874fab87525eaf3d3f5190514995d73611cecb94a416a24de31998904f160084211dadf1bd5bd48
SSDEEP

6144:ZMp6t4DREcMZ5vVCiiKrao9afJu3YYtWGaVoRiS6hxH5AgPaxA:ZMp6+FuvVCiisao9Ii3aViKHye

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  fc49ee4702a7c9d95dfaea0a014e3ff6cc678baa96361159fc459f016dfcba9d
- Size
  
  370KB
- MD5
  
  42578f059b473b2a62e141ab2a1a6ad4
- SHA1
  
  20f774b65ab478e5c661f3cb321b4ade47d4c7ae
- SHA256
  
  fc49ee4702a7c9d95dfaea0a014e3ff6cc678baa96361159fc459f016dfcba9d
- SHA512
  
  c797307fa268f857769b1158ec23a702be0c9f470cc521f01874fab87525eaf3d3f5190514995d73611cecb94a416a24de31998904f160084211dadf1bd5bd48
- SSDEEP
  
  6144:ZMp6t4DREcMZ5vVCiiKrao9afJu3YYtWGaVoRiS6hxH5AgPaxA:ZMp6+FuvVCiisao9Ii3aViKHye
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2